Certificate Chain Reference Conflict Due to Intermediate Certificate promoted as root certificate

Products

• VMware Avi Load Balancer

Issue/Introduction

Ideally a certificate chain consists of one leaf certificate, one intermediate certificates, and one root certificate
After an intermediate certificate is updated and promoted as root certificate, this update led the leaf certificate began referencing both the original root certificate and the newly created root certificate. The conflict arose because the new root certificate shared the same common name as one of the existing intermediate certificates, causing ambiguity when building the certificate chain. 

After Intermediate certificate is promoted to root Certificate, Leaf Certificate still displays old root certificate in chain

 

Environment

VMware

Cause

When generating parent references for the leaf certificate, the system iterates through the parent certificates to construct the list. The order in which certificates are fetched plays a role in this issue. The older intermediate certificates are considered first due to the fetch order, which leads to problems in identifying the correct parent certificate. As a result, an additional reference to the original root certificate is included, causing both root certificates to appear in the leaf certificate’s parent references.

 

Resolution

Upgrade to 22.1.7-2p4 for the permanent fix 

Workaround:
  When promoting an intermediate certificate to a root CA certificate

  Delete the entire certificate chain and re-upload the certificate,